Until recent years, there haven't been many informative and reliable data sources which we can use in cyber security to learn about where data breaches come from, how likely they are and what costs are associated.
For many years cyber security professionals were mostly playing guessing games and relying on their direct experience to help secure their organisations.
Not too long before that, cyber security 'people' consisted of IT admins who had to start wearing the cyber security hat in their organisation. We've come a long way.
In this blog series, we will look at and compare three data sources and discuss what causes cyber security breaches, how likely they are to occur and what the impact costs usually look like.
Data is important in many industries. In security, data is used heavily by people and vendors who want to sell things. However, it can also be used by security professionals to better understand the causes and effects, to spot trends and ultimately better protect our organisations with return on investment (ROI) in mind.
Return on investment in cyber security is important. It boils down to this - reducing the likelihood and impact of security breaches in the most effective and efficient way, using the usual resources: Time, Talent and sTerling (that's dollars, if you're not familiar with British coin).
But Ash, why is good data important in cyber security?
A wonderful question. Simply put, good data enables us to make better decisions. It helps us answer questions like: "how much risk do we have?" and "how do we get the best ROI in our security investments?".
The three data sources we will look at:
Why these reports? Well. I'm a big fan of people who undertake research for the good of the world, rather than to fill their pockets. None of the above organisations have a commercial interest in their research. What I mean by this is, for example, none of them are security vendors who are writing reports about the benefits of anti-virus technology, because they coincidentally sell anti-virus technology. (One could argue that the IRIS report producers, Cyentia, are a data research company, but that just gives them reasons all the better to produce great reports).
Additionally, each organisation openly discloses:
a. how they conducted their research and the methodologies used, and;
b. where they got their data from.
Lastly, and perhaps most subjectively, when reading these reports in comparison to others, I got a positive gut feeling and a strong sense of 'these people get it'. I cannot define this any further, but I'm sure you've felt the same way about things you read on the internet, or at least you've had the opposite sensations when reading a pile of crap.
Excited as me? Of course you are. Subscribe to automagically get notified when the next post is ready.
You can see part 2 here